+ jHjvpRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIHt^RIHtHt^RIHtHt^RIHt]P4!R4tRtRR ltR R ltR R lt]P@!R]PB4t"]P@!R]PB4t#RRlt$RRlt%RRlt&RRlt'RRlt(RRlt)Rt*Rt+Rt,RRlt-R R!lt.R"R#lt/R$R%lt0R&R'lt1R(R)lt2R*t3R+t4R,t5]3R-]4R.]5R//t6]5R/]4R0]3R1/t7^t8R2t9R3R4lt:R5R6lt;R7R8ltR=R>lt?R?R@lt@RARBltARCRDltBRERF/RGRHlltCRIRJltDRKRLltERMRNltFRORPltGRQRRltHRSRTltIRURV/RWRXlltJRYRZltKR[RR\R/R]R^lltLR_R`ltMRaRbltNRcRdltOReRfltPRgRhltQRiRjltRRkRlltSRmRnltTRoRpltURqRrltVRsRtltWRuRvltXRwRxltYRyRzltZR{R|lt[R}R~lt\RRlt]RRlt^RRlt_]`!0Rm4ta/]bPRR4C]bPRR4CtdRRlte]`!R4tfRRltgRRRllthRR/RRlltiRRltjRR/RRlltk]!R4tl]!R4]!R4]!R4]!R43tmRtnRRlto^k]p!R4, tqRtrRRltsRRlttRRltuRRltvRRltwRRltxRRltyRRltzR#)a6Desktop (Electron) app: build/stamp, stage-and-swap pack, exe integrity gate, macOS signing, Linux sandbox, launch (hermes gui/desktop). Split out of ``hermes_cli/main.py``. Names that still live in main (``PROJECT_ROOT``, ...) are imported lazily inside the functions that use them (avoids an import cycle). NPath)CallableOptional)desktop_console_outputdesktop_launch_notice)factszhermes_cli.mainuB ↩ The previous desktop app was left untouched and still works.c0V^8dQhR\R\/# desktop_dirreturnrbool)formats"VR, R, P4#)z;Return True when a local desktop renderer build is present.dist index.htmlexistsr s&r_desktop_dist_existsr!s & < / 7 7 99rcRV^8dQhR\R\R\\,/#)r r source_moder rrr)rs"rrr&s*SSdSDSXd^SrcfV'd VR, #\V4pVfR#VR, R, #)zThe renderer ``dist`` a launch loads: ``apps/desktop/dist`` in source mode, else the ``app.asar.unpacked/dist`` copy (the only real directory, and the one an interrupted replace tears).rNzapp.asar.unpacked)_packaged_resources_dir)r r resourcess&$ r_renderer_bundle_dirr!&s7V##' 4I$4R)6I*IF*RRrcFV^8dQhR\R\\,/#r rr)rs"rrr0s"sss(4.src\V4pVfR#\PR8XdVPPR, #VPR, #)zUThe packaged app's ``resources`` dir (renderer bundle, baked ``install-stamp.json``).Ndarwin Resourcesr )_desktop_packaged_executablesysplatformparent)r executables& rrr0sI-k:J58\\X5M:   # #k 1rS]SdSdgrSrrrz<<(?:script|link)\b[^>]*\b(?:src|href)=["']([^"']+)["'][^>]*>z1\btype=["']module["']|\brel=["']modulepreload["']c0V^8dQhR\R\/#r dist_dirr r)rs"rrr@sDTrc:VR, PRRR7p\PT4FpTP ^4p\ P TP ^44'd-\P!RT\P4'dKlTPR^4^,PR^4^,PR 4pT'gKY, P4'dKR # R# \dR#i;i) a_True when ``index.html`` names hashed module chunks that aren't there. A replace interrupted by locked files leaves index and ``assets/`` from different generations; the app dies on its first lazy import while the SOURCE-tree stamp still matches, so no rebuild fixes it. Conservative: an unreadable index or one naming nothing checkable is NOT torn. r utf-8-sigreplace)encodingerrorsFz ^[a-z]+:|^//?#z./T) read_textOSError_HTML_TAG_WITH_URLfinditergroup _MODULE_TAGsearchrematch IGNORECASEsplitlstripr)r.htmlr>hrefrels& r_renderer_bundle_tornrE@s<'22KPY2Z$,,T2{{1~!!%++a.11RXXotUWUbUb5c5c jja #))#q1!4;;DA 3..003  sD DDc0V^8dQhR\R\/#r-r)rs"rrrYs U U U$ UrcZVR, R, pVR, P4'gR#VR, R, .VR, P\P R24Op\;QJd&R V4F'gK R '*# R'*#!R V44'*#) aRTrue when the packaged node-pty has no native binary for this OS. The main process requires node-pty at startup, so such a package dies before any window opens while the source stamp still matches (#62462). Same places node-pty's loader and stage-native-deps.mjs look. Conservative: a package without node-pty at all is not judged here. node_modulesznode-pty package.jsonFbuildRelease prebuildsz-*c3"TF7qP4'gK\VPR4R4xK9 R#5i)z*.nodeN)is_dirnextrglob).0ds& r -_packaged_node_pty_missing..fs,T+Q04)400+s A#AT)is_fileglobr(r)any)r.root native_dirss& r_packaged_node_pty_missingrZYs n $z 1D > ! * * , ,'>I-_ 1C0I0IS\\NZ\J]0^_KsT+Tss TTs TTsT+TT TTrcHV^8dQhR\R\R\R\/#)r r project_rootrr r)rs"rrris0]]t]4]QU]Z^]rcRV'd\V4'gR#M\V4fR#\WR7pVe#\V4'd\ RV R24R#V'g#Ve\ V4'd\ R4R#^RIHpVRJ;'gV!VRV4'*#) zWTrue when the desktop build output is stale, missing, torn, or built in the other mode.TNru< ⚠ A previous update left the desktop bundle incomplete (z); rebuilding ituK ⚠ The packaged desktop app has no node-pty native binary; rebuilding it)source_product_currentdesktop)rr'r!rEprintrZhermes_cli.source_buildr_)r r\rr.r_s&&$ r_desktop_build_neededrcis#K001 %k 2 :$KIH 5h ? ? LXJVfgh 8/4Nx4X4X [\> t  \ \#9, S[#\\\rc<V^8dQhR\R\R\/#)r r r\r r)rs"rrrs'SSDSSQUSrc\V4pVfR#^RIHp^RIHpV!V4P R4p\ V\4'dWT!VRR48wdR#\WRR7'*#)aTrue when the packaged app was built from HEAD and none of its inputs changed since. Freshness alone cannot answer this for an update: the baked ``install-stamp.json`` is a desktop input that only the build itself rewrites, so after a pull that touched no other desktop input the receipt still reads current while the app names the previous commit. The commit the packaged app actually ships is the missing half; anything unreadable means "build". F)read_install_stamp)_run_gitcommitz rev-parseHEADr^) rhermes_cli.stewardrfhermes_cli.version_inforgget isinstancestrrc)r r\r rfrgrhs&& r"_packaged_desktop_current_for_headrosc( 4I50  * . .x 8F fc " "f{TZ0[&[$[ER RRrcFV^8dQhR\R\\,/#r r#)rs"rrrs"DDdDx~Drc&\VR, 4#)z?Return the current platform's unpacked Electron app executable.release)_desktop_packaged_executable_inrs&rr'r's *;+B CCrcFV^8dQhR\R\\,/#r release_dirr r#)rs"rrrs : : :(4. :rc~\PR8Xd\VPR44pM]\PR8Xd RUu.uFq V, R, NK ppM)R UUu.uFpR Fq0V, V, NK K pppVUu.uFqDP 4'gKVNK ppV'gR#\PR8XdH\ V4^8d8\ 4pVUu.uFp\V4V9gKVNK ppV'dTp\VRR7#uupiuuppiuupiuupi) uThe unpacked Electron app executable under *release_dir* (live ``release`` or a staging dir). *release_dir* is electron-builder's ``directories.output`` — the live ``apps/desktop/release`` or a stage-and-swap staging dir (#86443). r%z%mac*/Hermes.app/Contents/MacOS/Hermeswin32z Hermes.exeNc6VP4P#N)statst_mtimeps&r1_desktop_packaged_executable_in..sqvvx'8'8r)key)z win-unpackedzwin-ia32-unpackedzwin-arm64-unpacked)zlinux-unpackedzlinux-arm64-unpacked)hermesHermes) r(r)listrVrlen_expected_windows_pe_machines_pe_machine_or_nonemax)rv candidatesrRnr~existingexpectedmatchings& rrsrss$  ||x+**+RST  4o 4oq!Ol * *4o  *T )SA]qXY!Oa  ]q )S  &4:a:H4  ||w3x=1#412'Nx!+>q+AX+MAAxN H x8 99/  5Os$ D**!D/D5.D53D: D:z .staging-z .previousc4V^8dQhR\R\RR/#r srcdstr Nr)rs"rrrs!  d  $ rc x\\^R7Fwr#\P!W4R# \P!W4R# \ddp\ P RTPTPT\\4^,Y44\P!T4Rp?KRp?ii;i)zd``os.rename`` that retries a transient PermissionError with bounded backoff; re-raises the last one.)startNzXdesktop promotion rename %s -> %s hit a file lock (attempt %d/%d), retrying in %.1fs: %s) enumerate#_DESKTOP_SWAP_RENAME_RETRY_DELAYS_SosrenamePermissionErrorloggerwarningnamer _time_modsleep)rrattemptdelayexcs&& r_rename_riding_out_file_lockrs#$GqQ # IIc  RIIc  # NNj#((GS1T-UXY-Y[`  OOE " "  #sA  B9AB44B9c0V^8dQhR\R\/#r r)rs"rrrs[[d[t[rcVP\ R24Fp\P!VRR7K V\ \P !4 R\ \P!44 2, #)uFresh staging dir ``apps/desktop/.staging--``: a sibling of ``release/`` (same fs → the swap is a rename) but not inside it, so ``release/*-unpacked`` globs never see it. Sweeps leftovers.*T ignore_errors-) rV_DESKTOP_STAGING_PREFIXshutilrmtreergetpidintrtime)r stales& r_desktop_staging_dirrs`!!%<$=Q"?@ e40A 34RYY[M3y~~GWCXBYZ ZZrc<V^8dQhR\R\R\/#)r exervr r)rs"rrrs!4DrcTpVPV8wd0VPV8Xd\V RV 24hVPpK@V#)zeThe dir directly under *release_dir* holding *exe* (electron-builder's ``appOutDir``, swapped whole).z is not under )r* ValueError)rrvunpackeds&& r_desktop_unpacked_rootrsCH //[ ( ??h &uN;-@A A?? Orc4V^8dQhR\R\RR/#)r liveasider Nr)rs"rrrs! - -D - -$ -rcBVP4'gAVP4'd+VPV4\P RV4R#\ P!VRR7R# \ d#p\P RYT4Rp?R#Rp?ii;i)aJFinish a swap that died between its two renames before starting a new one: a missing ``live`` with its ``aside`` copy present means the previous app was moved out and nothing moved in, so put it back; otherwise ``aside`` is leftover. Deleting ``aside`` first (as the swappers used to) destroyed the only remaining copy of the app.z0restored %s from an interrupted desktop app swapNz could not restore %s from %s: %sTr)rrNrrrr7rr)rrrs&& r_recover_interrupted_swaprsr ;;==U\\^^  LL  NNMt T  MM%t,  NN=tC P  s'A11 B<BBcRV^8dQhR\R\R\\,/#)r r staging_dirr r#)rs"rrrs%&;&;$&;T&;htn&;rc\V4pVf\P!VRR7R#VR, p\W!4pW4P, pW4P\ ,, pVP RRR7\WV4VP4pV'd7\VRR7pV'd\PRV4\WV4\WE4T'd\P!TRR7\P!TRR7YRP!T4, # \dT'd \Ye4hi;i \\3d:p \PRT 4Rp ? \P!TRR7R#Rp ? ii;i \P!TRR7i;i) uPromote a VERIFIED staged pack over ``release/`` by two renames (live → ``.previous``, staged → live); a failure between them rolls back. Returns the live exe or None (live app kept). Never raises.NTrrr)parentsexist_ok) also_posixz9stopped desktop processes before staged app promotion: %sz0desktop stage-and-swap failed, live app kept: %s)rsrrrr_DESKTOP_PREVIOUS_SUFFIXmkdirrr%_stop_desktop_processes_locking_buildrinforr7rr relative_to) r r staged_exerv staged_root live_rootprevious moved_asidestoppedrs && r_swap_staged_desktop_apprs`1=J k6 )K7,ZE "2"22 "2"25M"MN$6!)6&&(  >RXR^R^C_1`H%%.06 H%%-uH%'8:JK\\!_  , ,Wll:6N O O    = = = LL ! L   trc$V^8dQhR\/#rrn)rs"rrr_s...rc2\PR8XdWRRRRRR/P\P!4\P !4;'gRP 44#\P !4;'gRP 4#) zCReturn the native Windows machine name in upper-case PE vocabulary.rxarm64ramd64rx86r)r(r)rlr native_archrupperrr_windows_native_machiner_sx ||w'7E5AEE    ("2"2"4":":!A!A!C       $ $" + + --rc$V^8dQhR\/#r)r)rs"rrrhsDDsDrcV\PR8Xd\4pV'dV#\4P4pVR9d \\0#VR9d \\0#VR9d\0#\\\0# \\\ \ 3dRpLi;i)uPE machines this Windows host can load: ``GetMachineTypeAttributes``, else by name (AMD64 → x64+x86, ARM64 → ARM64+x64, x86 → x86). Unknown hosts get the full set so the gate can never brick launch.rxN)rX86_64X64)rAARCH64)rI386I486I586I686) r(r)rr7AttributeError TypeErrorrrrrrr)rrs rrrhs ||w 9;H O%'--/G,,!#344&&!#45599 !! 02B CCJ? H s BB('B(c0V^8dQhR\R\/#r pathr )rr)rs"rrr|s%%D%S%rc 8^RIpVP4PpTR8d\ RT R24hTP R4;_uu_4pTP ^@4p\T4^@8gTR,R8wd \ R 4hTPR T^<4^,pT^8:gT^,T8d \ R 4hTPT4TP ^4p\T4^8gTR ,R 8wd \ R4hTPRT^4wrTPRT^4^,p TPT^,T ,4^p \T 4FVp TP ^(4p \T 4^(8d \ R4hTPRT ^4wr\YT,4p KX Y+8d\ RT RT R24hRRR4T# \dp\ RT 24hRp?ii;i +'giX#;i)zCOFF machine field of the PE at ``path``; ``ValueError`` with a readable reason when it is not a structurally complete PE (bad magic, truncated header, section data past EOF). Header walk only.Nz unreadable: iz file is only u3 bytes — far too small to be a Windows executablerb:Nr NsMZu^missing MZ header — not a Windows executable (a truncated or non-binary file saved as .exe?)zT"X.p %%dD$7: q=HrMI5[\ \ ''"+ w<"  } <QR R$00C!--dGR@C 2 001z"AggbkG7|b  !=>>*0*<*\V4# \dR#i;irz)r rr s&rrrs$ && s cFV^8dQhR\R\\,/#rrrrn)rs"rrrs  t  rc\V4pT\49d,\P TRTR 24pRT R\ 4 R2#R# \dp\T4uRp?#Rp?ii;i)zVWhy ``path`` cannot run on this Windows host, or None when it parses as a loadable PE.Nzunknown machine 0x04Xzarchitecture mismatch: built a z executable but this is a z Windows host)r rrnr_PE_MACHINE_NAMESrlr)r rrgots& r_desktop_exe_integrity_errorr+sz#D)355##G/A'#-OP-cU2L&() 8   3xs A A) A$A)$A)c0V^8dQhR\R\/#r r\r r)rs"rrrs6666rcVR, R, R, R, pVP4'dV#VR, R, #)zThe installed Electron package dir: workspace-local ``apps/desktop/node_modules/electron`` (where ``electronDist`` points) when present, else the root hoist npm sometimes uses instead.appsr`rHelectronr)r\ desktop_locals& r _electron_dirr2sB!6)I5FSM . (: 55rc0V^8dQhR\R\/#rur)rs"rrrs$4rcV\VP44P4P9# \dR#i;i)zXTrue when *proc*'s executable lives inside *release_dir* (False when it cannot be read).F)rrresolver Exception)procrvs&&r _runs_fromr8s>d488:.668@@@@ s36 AAcFV^8dQhR\R\\,/#r r")rs"rrrsdx}rc:^RIpVR, P4p\VP\P !44P 44pTF+p\YB4'gK\TP4u# R# \dR#i;i)aTPID of a Desktop from this build's ``release`` tree that is one of OUR ancestors, else None. That Desktop is running this process (its backend's launch-time update tail, or a `hermes update` it spawned). On Windows it holds the exe lock the promotion rename needs, and it cannot be stopped without killing this process first. Never raises.Nrr) psutilr5rProcessrrrr6r8rpid)r r;rv ancestorsr*s& r_desktop_ancestor_inr?s} "Y.779  4<<>?  f * *vzz? "  sAB BBrFcRV^8dQhR\R\R\\,/#)r r rr )rrrr)rs"rrrs-XXtXDX]abe]fXrc t\PR8wd V'g.#^RIpVR, P4pTP 4'g.#\ P!4p\4p\TPT4P44pTFpTPTP4\Ys4'gK1\P !\4;_uu_4TP#RTP%RR744RRR4K .pTP'RR.4p T Fp T P(p T P+R4p T P+R4p T 'dT e Y8XgY9dKL\-T 4P4pY>P9gKwTP/T 4K .pTF8p T P14TP/\3T P44K: T'd\P !\4;_uu_4TP5T^R 7wpp.pTF%p T P74TP/T 4K' T'dTP5T^R 7RRR4T#T# \d.u#i;i \d.pEL&i;i +'giEK:;i \d.u#i;i \dEKi;i \dEKBi;i \dKi;i +'giT#;i) uTerminate a running desktop app whose exe lives INSIDE this build's ``release`` tree. Windows needs it everywhere: the exe lock makes the pack die with ``Access is denied``. POSIX can rename a running app's files away, so the pack itself needs no stop — but a renderer left alive through the stage-and-swap promotion keeps fetching its OLD hashed chunks by path after the swap and dies on the next lazy import (#109643), so the swap point passes ``also_posix=True``. Never raises; returns the PIDs asked to stop.rxNrrc38"TFqPxK R#5irz)r=)rQchilds& rrS8_stop_desktop_processes_locking_build..sQ1P))1PsT) recursiver=r)timeout)r(r)r;r5r6rNrrrrr<rrr=r8 contextlibsuppressupdatechildren process_iterrrlrappend terminater wait_procskill)r rr;rvmesparedr>r*victims proc_iterr7rr=rexe_pathrralivekilleds&$ rrrs ||wz "Y.779       B&uF+3356  6::&..    + + MMQ41PQ Q, + G''7  99D((5/C((5/C#+cmCy((*H ** * NN4 G  NN  NN3txx= )    + +((!(=K> LL L# L&"L# #L&& L7 cFV^8dQhR\R\\,/#)r bundler r&)rs"rrr8s))T)hsm)rc^RIpVR, R, pVP4'g\VPR8XdK\VP R44\VP R44,pV'd V^,pVP4'gR#VP VP 44pTPR4pT'd \T4#R# \dR#i;i)zEReturn a bundle/framework CFBundleIdentifier for local macOS signing.NContentsz Info.plist .frameworkzVersions/*/Resources/Info.plistzResources/Info.plistCFBundleIdentifier) plistlibrsuffixrrVloads read_bytesr6rlrn)rXr]rrdataidents& r_desktop_macos_bundle_idrc8s J  -D ;;==V]]l:&++&GHID KK. /M11 a=D ;;==~~doo/0 HH) *E3u:(D( sC$$ C32C3c:V^8dQhR\\,/#rrrn)rs"rrrKsx}rcr\PR8wdR#^RIHpV!4P R/4p\ V\ 4'gR#VP R4p\ V\4'gR#VP4;'gR# \dp\RT R24Rp?R#Rp?ii;i)u``desktop.macos_signing_identity`` — a persistent (even self-signed) code-signing cert anchors the Designated Requirement and keeps TCC grants stable across rebuilds. Unset → ad-hoc.r%N load_configr`macos_signing_identityz; (warning: could not load desktop.macos_signing_identity: z!; falling back to ad-hoc signing)) r(r)hermes_cli.configrhrlrmdictrnstripr6ra)rhr`identityrs r%_desktop_macos_local_signing_identityrnKs ||x1-##Ir2'4((;;78(C((~~''4'  Ie4 6  s)3B'B7BB B6B11B6cPV^8dQhR\R\R\P/#r codesignappr )rnr subprocessCompletedProcess)rs"rrras,__s__J> :xSX> _OS _W] __rcRV^8dQhR\R\R\\,/#rp)rnrrrk)rs"rrrfs%s(4.rc Va\P!VR\V4.RRRRRR7pTP RTP 2oTP ^8wdR#R T3R llpT!R 4pR TR9dRMTR T!R4R\YRR7P ^8H/# \dR#i;i)uBest-effort signing identity of a ``.app`` bundle: ``{team, identifier, verified}``. ``None`` when the bundle has no readable signature (``codesign -dv`` fails — e.g. an unsigned bundle). ``team``/``identifier`` are ``None`` when the signature lacks them (ad-hoc signatures report ``TeamIdentifier=not set``); ``verified`` is the strict ``--verify --deep --strict`` result. Never raises. -dvFTutf-8r1checkrwtextr2r3N cFV^8dQhR\R\\,/#r rr )rnr)rs"rr._macos_signature_summary..__annotate__xs38C=rc<SP4FLpVPV R24'gKV\V4^,RP4;'gRu# R#)=N) splitlines startswithrrl)rlineoutputs& rfield'_macos_signature_summary..fieldxsV%%'D#ay))CHqLM*002::d:(rTeamIdentifierteam identifier Identifierverifiedr)Nznot set)rsryrnr6stdoutstderr returncoder{)rqrrrrrrs&& @r_macos_signature_summaryrfs~~ uc#h 'uT ;  }Bt{{m ,F ! ! "D 11teL)$X%@KKqP  s(B B('B(chV^8dQhR\R\\,R\\,/#)r installedrebuiltr )rkrrn)rs"rrrs,dXd^PXY\P]rczVR,'gR#VeVR,'gRVR, R2#VR,VR,8wdRVR, RVR, R2#VR,'d>VR,'d/VR,VR,8wdR VR,: RVR,: R 2#VR ,'gR #R#) uAReason to refuse swapping a publisher-signed installed app for ``rebuilt``, or None. #123748: replacing a Developer ID (Team ID) installation with a locally signed or ad-hoc rebuild — or any bundle whose signing identity or bundle identifier differs — invalidates the code-hash-bound keychain ACLs the app's safeStorage credentials are encrypted under and resets TCC grants. Ad-hoc-to-ad-hoc replacement (the local development flow) is untouched. ``installed`` is a ``_macos_signature_summary`` dict; ``rebuilt`` is None when the rebuilt bundle has no readable signature. rNzpublisher-signed app (Team ID z) would be replaced by a locally signed or unreadable build; kept the existing app. To update it, sign the rebuild with the publisher identity (CSC_LINK / APPLE_SIGNING_IDENTITY) and update again.zpublisher Team ID z does not match rebuilt zg; kept the existing app. Check the signing identity in desktop.macos_signing_identity and update again.rzbundle identifier zN; kept the existing app. Align the build's bundle identifier and update again.rzrebuilt bundle failed strict signature verification; kept the existing app. Re-run the build; if it persists, inspect with `codesign -vvv`.r)rrs&&r_macos_signing_downgrade_errorrs V  gfoo061B0CD<< =v)F++$Yv%6$77O6?#$FG H ,GL$9$9,'7<+@@$Y|%<$??W<(+,67 8 :  W rc0V^8dQhR\R\/#)r rrr r)rs"rrrs$rc d\P!R4pV'gR#\P!VR\ V4.RRRRRR7pVP RVP 2pVP^8wgR V9gR V9dR#\WRR 7P^8H# \dR#i;i) uTrue when the bundle has an intact Team-ID signature, so the fixup never clobbers a notarized build with ad-hoc (resets TCC). A STALE real signature fails --verify → False → repairable.rqFr~Trr1rrzTeamIdentifier=zTeamIdentifier=not setr) rwhichrsryrnrrrr{r6)rrrqrrs& r'_desktop_macos_has_valid_real_signaturers||J'H ~~ uc#h 'uTPT_foxzKK=4;;-0 ??a #4F#BF^bhFhU;FF!KK sA"B B B/.B/rmrcHV^8dQhR\R\R\R\/#)r rrr rmr )rrnr)rs"rrrs/AAtATASA[_Arcaa\P!R4oS'gR#VR, R, pVR, R, pVP4'dVP4'g\RVR, 24hRRR RR R /R VV3R lllpVR, p.p\P !V4Fwrp \ V4p \;QJd5RV PV4P4F 'gK R M* RM&!RV PV4P44'dKV F6p W, p V R9gV PR9gK%VPV 4K8 K \VRR R7F p V!V RR7K \4pVR, pVP4'dP\P !V4F5wrp\ V4pVPR9gK$VPV4K7 \VRR R7FpV!VV\V4R7K V!W\V4R7\!SVR R7R #)uOSign a local build inside-out (Mach-O files, nested frameworks/helpers, main bundle) with the repo's entitlements and an identifier-pinned DR when ad-hoc — a plain ``--deep --sign -`` gives a cdhash-only DR (TCC re-prompts every rebuild) and strips the JIT/mic entitlements. Raises on signing failure; True after strict verification.rqFr0zentitlements.mac.plistzentitlements.mac.inherit.plistz)desktop entitlement plists missing under entitlementsNrruntimeTc xV^8dQhR\R\\,R\\,R\RR/#)r r rrrr N)rrrnr)rs"rr3_desktop_macos_local_codesign..__annotate__s= > > >%-d^ >HPQT  > >!% >rc:<SRRSR.pV'd VRR., pVe+VP4'dVR\V4., pV'dSR8XdVRR V R 2., pVP\V44\P!VR R R 7R#) --force--signz--timestamp=nonez --optionsrNz--entitlementsrz--requirementsz=designated => identifier ""Trrw)rrnrLrsry)r rrrargsrqrms&$$$ r sign_path0_desktop_macos_local_codesign..sign_paths)Xx9KL  [), ,D  # (;(;(=(= %s<'89 9D (c/ %)DZLPQ'RS SD CIt4=rrZc3B"TFqPR4xK R#5i).appN)endswith)rQparts& rrS0_desktop_macos_local_codesign..sR1Q}}V$$1Qsc,\VP4#rzrpartsr}s&rr/_desktop_macos_local_codesign..s s177|r)rreverse)r Frameworksc,\VP4#rzrr}s&rrrs AGG r)rrr>chrome_crashpad_handler spawn-helper>.node.dylib>rr[)rrrFileNotFoundErrorrwalkrrWrrr^rLsortedrrrcr{)rrr rment_main ent_inheritrcontents standalonerX_dirsfiles root_pathrfpbundlesframeworks_dir_filesr~rXrqs&$d @r_desktop_macos_local_codesignrs ||J'H Z'*BBH *-MMK OO  +"4"4"6"6 "KKZdLdKe fgg >6: >X\ > > >$ZHJ ggh/UJ 3R1F1Fs1K1Q1QR333R1F1Fs1K1Q1QR R R D!BBBbiiSfFf!!"% 0Z%;TJ"e$KG ,N#%77>#: DT Axx11 A$;&BU!&)*+WW H TVWZV[\&&   0X[\\= ]    9#>Z[\\I$]srG+/G> G>+ G;:G;> K  KK.K=KK1JK J-!J(#K(J--KK c>V^8dQhR\R\R,/#)r app_pathr N)rrn)rs"rrrys  T cDj rcaVR, R, R, pVP4'gR#\P!4p\VR4;_uu_4o\ V3RlR4FpVP V4K RRR4VP 4# +'giL ;i \dR#i;i)zCReturn the SHA-256 hex digest of an app bundle's app.asar, or None.rZr&zapp.asarNr c&<SPR4#)i)rfsrr _app_asar_hash..s affUmrr)rUhashlibsha256riterrI hexdigestr7)rasarhchunkrs& @r_app_asar_hashrys j ; . ;D <<>>A $  3S9:{{}  s*B/)BB/ B, 'B// B>=B>c@V^8dQhR\R\R\RR/#)r tmptargetoldr Nr)rs"rrrs(++4++D+T+rcRpVP4'dVPV4RpVPV4\P!TRR7R# \d\P!TRR7hi;i \dlpRpT'd.TPT4M \d pTpRp?MRp?ii;i\P!TRR7Te\RT RT 24ThhRp?ii;i)zDMove a staged macOS bundle into place without losing the old bundle.FTrNz C7 C2B)(C2) C4B;6C2;C2C22C7c:V^8dQhR\\,/#r)rr)rs"rrrs  CI rcB^RIp\4pVPR.4FzpVPP R4;'gRpVP R4'gKAVP \V4P4P^,4K| V#)a``.app`` bundles of every live Hermes Desktop process. A running bundle is never swapped under: Electron loads ``app.asar`` chunks and helper apps lazily, so renaming its bundle away and deleting the old tree crashes the live app (the detached updater waits for it to exit).Nrrz/Contents/MacOS/Hermes) r;rrKrrlrrrr5r)r;rr7rs r_running_macos_app_bundlesrszG##UG,iimmE"((b <<0 1 1 KKS ))+33A6 7- Nrc4V^8dQhR\R\RR/#rr)rs"rrrs&\\$\T\d\rcb\P!R\V4\V4.RRR7R#)z``ditto`` copies a bundle with its signature, xattrs and symlinks intact (``shutil`` drops the resource-fork metadata codesign verifies).z/usr/bin/dittoTrNrx)rrs&&r_stage_macos_bundle_copyrs%NN$c#hC9VZ[rc V^8dQhR\R\\,R\\\,\\,3,/#)r r rr )rrtuplern)rs"rrrsBRRdRT RuUYZ^U_aefiajUjOkRrc\PR8wd..3#\V4pVf..3#\VP^,V\ 4R7#)a*Copy the rebuilt macOS bundle into every stale or missing installed ``Hermes.app`` in *candidates* (``_installed_desktop_apps()``) (#52339). ``hermes desktop --build-only`` (what ``hermes update`` runs) packages into ``apps/desktop/release/`` only. Finder, the Dock and Spotlight launch the copy in ``/Applications`` (or ``~/Applications``), so without this step every update leaves the installed shell one build behind the backend it boots. The detached Desktop updater swaps only the bundle it was launched from, so an app running from ``release/`` never refreshed the installed copy either. Returns ``(installed, problems)``: bundles that were (re)installed, and one user-facing line per bundle that could not be (running, copy or swap failure). Both empty means every installed copy was already current. r%)running)r(r)r'_install_rebuilt_macos_bundlesrr)r r rebuilt_exes&& r_install_rebuilt_desktop_apprsW ||x2v .{;K2v )A 4N4P RRrc(V^8dQhR\RR/#)r r r Nr)rs"rrrsKKK$KrcP\4'gR#\4pVUu0uFq"P4'dKVkK pp\W4wrEVF(pW#9d\ RV R24K\ RV 24K* VFp\ RV 24K ^RIHp^RIHpH p VUu.uFp\V4NK p pV !V!44PR.4V 8XdR#V!V!4RV /4R#uupiuupi \dp \ R T R 24Rp ? R#Rp ? ii;i) zInstall the rebuilt bundle over stale or missing installed copies, report each outcome, and record which copies this update keeps current.Nu% ✓ Reinstalled the Desktop app at zN: it had been removed, so Finder, the Dock and Spotlight could not find Hermesu+ ✓ Installed the rebuilt Desktop app at u ⚠ )desktop_install_record)atomic_json_writeread_json_or_emptyr/u2 ⚠ Could not record the installed Desktop app (r) _owns_installed_desktop_apps_installed_desktop_appsrrrahermes_cli.gui_uninstallrutilsr r rnrlr7) r ownedrrmissingrproblemsproblemrr r r/rs & r_refresh_installed_desktop_appsrs% ( ) ) # %E#8es:: 9#?AA B ?uE F   wi !?;!& &CHD &02377CtKK02VTNC%9 ' K B3%qIJJKs(C6C6)C;$D D% D  D%c\V^8dQhR\\,R\\,/#)r rr rr)rs"rrrs"DJ4:rcH.pVFp\P!VR, R, R, PRR74p\ T\ 4'gKWTPRR4R8XgKpTPT4K V# \\3dKi;i)aThe existing bundles in *candidates* that only ``hermes update`` keeps current (#52339). Ownership comes from the bundle's own ``install-stamp.json``. ``updateMechanism: self`` is a bootstrap build (a local pack or the bootstrap download), and stamps older than the field predate every self-updating kind. Bundled/light releases update themselves and commit builds are external, so a local build must never be copied over them. No readable stamp, no claim. rZr&zinstall-stamp.jsonr0r2updateMechanismself) jsonr_r6r7rrmrkrlrL)rrrrstamps& r_update_owned_macos_bundlesrs E JJj 0; >AU U``ju`vwE eT " "uyy1BF'Kv'U LL   L $   s;B  B! B!c$V^8dQhR\/#rr)rs"rrrsbbdbrc\PR8wdR#^RIHp^RIHp\ V4P4V!4R, P48H#)zA packaged app runs the checkout under the default Hermes home, so only that checkout (on macOS) may build for it: a bundle from any other tree (a dev worktree) would split shell from backend.r%F PROJECT_ROOT)get_default_hermes_rootz hermes-agent)r(r)hermes_cli.mainr!hermes_constantsr"rr5)r!r"s rr r sD ||x,8   % % ',C,E,V+_+_+a aarc:V^8dQhR\\,/#rr)rs"rrrsTTdTrcd\4'g.#^RIHpHp^RIHpV!4p\ V4;p'dV#V!V!44PR4p\V\4'g.#VUu.uF/p\V4V9gKVP4'dK-VNK1 up#uupi)aInstalled macOS ``Hermes.app`` bundles this checkout's update owns. When no owned copy is left, a recorded one that has gone missing still counts: its ownership stamp left with the bundle, and without the record nothing would ever put it back (Finder, the Dock and Spotlight lose Hermes for good). A copy moved to the other Applications folder keeps its stamp, so it is found instead of doubled. Hermes' GUI uninstall deletes the record. )rpackaged_gui_app_paths)r r/) r r rr'rr rrlrmrrnr)rr'r rrrecordedrrs rr r s ( ) ) W(')J+J77u7 !"8":;??GH h % % % S:CSX)=CcjjlCC: SS Ss5B- B-$B-c<V^8dQhR\R\R\/#)r r packaged_executabler r)rs"rrr#s"$TVZrc\PR8wdV#\V4\VP^,4p\ 4F2pVfK \V4V8XgKVR, R, R, u# V#)aThe executable ``hermes desktop`` launches: the installed app once it IS the checkout build. Finder, the Dock and Spotlight open the installed ``Hermes.app``; launching the ``release/`` bundle beside it ran the same app from a second path while the installed copy went stale (#52339). Refresh the installed copies, then launch the first one that matches the checkout build. The checkout bundle stays the fallback: nothing installed, or a copy that is running or could not be replaced. r%rZMacOSr)r(r)rrrr )r r* rebuilt_hashrrs&& r _installed_desktop_launch_targetr.#sp ||x""#K0!"5"="=a"@AL&(  #s(;|(K#g-8 8) rc V^8dQhR\R\\,R\\,R\\\,\\,3,/#)r rebuilt_apprrr )rrrrrn)rs"rrr6sL...'+Dz.?B4y.MRSWX\S]_cdg_hShMi.rc \\V4pVf..3#\P!R4pV'd \W@4MRp.p.pVEFlp\ WP VP R2, 4\ WP VP R2, 4VP4'd\V4V8XdK~VP4V9dVPV R24KV'd;\WH4p V e,\W4p V 'dVPV RV 24KVP VP R2, p VP VP R2, p \P!V RR 7\W 4\WV 4TPT4EKo Wg3# \\P 3dXp \P!T RR 7TP#4'dR MR pTPT R T R T 24Rp ? EKRp ? ii;i)uStage-and-swap ``rebuilt_app`` into each bundle path in ``candidates`` that is missing or whose ``app.asar`` differs. The rebuilt bundle already carries the stable local signing identity and no quarantine xattr (``_desktop_macos_relaunchable_fixup``); ``ditto`` preserves both, so nothing is re-signed here and TCC grants survive. A publisher-signed (Team ID) installation is never replaced by a locally signed build or a different signing/bundle identity — the swap is refused and reported instead (#123748).Nrqz.hermes-update-oldz.oldzt is running and was not refreshed; quit Hermes Desktop and run `hermes update` again (or update from inside the app)z not refreshed: z.hermes-update-newTrz; the previous app was keptrz could not be installed (r)rrrrrr*rrNr5rLrrrrr7rsCalledProcessErrorr)r0rrr-rq rebuilt_sigrrrr installed_sig downgraderrrkepts&&$ rrr6s"+.L2v ||J'HEM*8ASWKIH "#zzsxxj@R4S'ST!#zzsxxj4E'EF ::<   667  MM#T 247JJLL0bD OOse#??C`dgCg)0C%& rc$V^8dQhR\/#rr)rs"rrrssrc\PPR^4R8XdR#\PR8wdR#\ \R4'd\P !4^8XdR#\RRR 7;_uu_4pVP4P4R8HuuR R R 4# +'giR #;i \dR#i;i) uTrue when Electron should run ``--no-sandbox``: Ubuntu 23.10+ ``apparmor_restrict_unprivileged_userns`` breaks the userns sandbox without a root-owned 4755 helper. Deliberately NOT True for root — Electron as root without a sandbox must stay an explicit choice.ELECTRON_DISABLE_SANDBOX1TlinuxFgeteuidz6/proc/sys/kernel/apparmor_restrict_unprivileged_usernsrrN) rrrlr(r)hasattrrBrrrlr7rs r_desktop_linux_needs_no_sandboxrDss zz~~0!4; ||wr9"**,!"3 JU\ ] ]ab668>>#s*^ ] ] ] s02C!B3( C3 C >CC CCc$V^8dQhR\/#rr)rs"rrrsrcF\PR8wdR#\P!R4pV'gR#\P !VRRR.\P \P ^RR7P^8H# \\P3dR#i;i)uTrue when the unprivileged userns sandbox works (probed with ``unshare``, fails closed) — then the setuid ``chrome-sandbox`` helper is never consulted and no sudo prompt is needed.rAFunsharez--userz--map-root-usertrue)rrrFr) r(r)rrrsryDEVNULLrr7TimeoutExpired)rGs r'_desktop_linux_userns_sandbox_availablerKs ||wll9%G  NN($5v>!))*2D2DaW\ j    Z.. /sABB B c|V^8dQhR\R\\\\P,3,/#r r*r )rrrr stat_result)rs"rrrs-tdHR^^D\>\8]rcvVPR, pWP43# \dTR3u#i;i)u[``(chrome-sandbox path, lstat or None)`` — lstat so a symlink is inspected, not followed.zchrome-sandboxN)r*lstatr7)r*sandboxs& r_sandbox_helper_lstatrRs@!((+;;G '' }s &88cDV^8dQhR\PR\/#)r str )rrNr)rs"rrrs"AAr~~A$ArcvVP^8H;'d$\P!VP4R8H#)ri )st_uidr{S_IMODEst_mode)rTs&r_sandbox_helper_is_setuid_rootrYs* 99> @ @dll2::6&@@rc0V^8dQhR\R\/#rMr)rs"rrrs77t7PT7rc\PR8wdR#\V4wrVRJ;'d!\P!VP 4#)z=Return True when ``chrome-sandbox`` exists as a regular file.rAFN)r(r)rRr{S_ISREGrXr*_sandboxrTs& r-_desktop_linux_sandbox_helper_is_regular_filer_s= ||w()<=LH T> 6 6dll2::66rc0V^8dQhR\R\/#rMr)rs"rrrs99d9t9rc*\PR8wdR#\V4wrVP4'g\ RV 24R#Vf\ RV 24R#\ P !VP4'g\ RV 24R#\V4'dR#\4'd\ R4R#\P!R 4pV'g\ R 4R#\ R 4\PRJ;'g$\PP4'*pVR R \V4.VRR\V4.3FpV'dVP!^R4\"P$!TV'd\"P&MRV'd^>   OPWyYZ z A'KL << # # KG9UV%b)).00 WX << D  ^_ LM))t+EE3993C3C3E/E7KW>wPVX[\cXd@ef  NN1d # ",;j((-4 I %%*Br MgYW Xg % 334 B s6<G$G5G2G2'G2 G/.G/2HHc0V^8dQhR\R\/#rMr)rs"rrrsbbTbdbrc\PR8wdR#\V4wrVRJ;'d9\P!VP 4;'d\ V4'*#)zTrue when a present, non-setuid ``chrome-sandbox`` would make Chromium abort with ``setuid_sandbox_host`` despite a working userns sandbox (call after the fixup's userns path).rAFN)r(r)rRr{r\rXrYr]s& r+_desktop_linux_needs_disable_setuid_sandboxrqsQ ||w()<=LH T> a adll2::6 a a?]^`?a;aarr@0c2V^8dQhR\R,/#)r r Nr)rs"rrrscDjrc *\PPRR4P4pV'dRRRR/PVR4#\PPR4'dR#\PPR 4'dR #\P !\ 4;_uu_4\P!.ROR ^R R 7pVP^8Xd RRR4R #RRR4R# +'giR#;i)uChromium password-store backend for this Linux session (KDE env → GNOME Keyring socket → D-Bus ping of org.freedesktop.secrets), or None. Chromium's own detection fails under the launcher env, and safeStorage then reports encryption unavailable.KDE_SESSION_VERSIONr6kwallet65kwallet5kwalletKDE_FULL_SESSIONGNOME_KEYRING_CONTROLgnome-libsecretTF)rwrFrN)z dbus-sendz --sessionz --print-replyz--reply-timeout=2000z--dest=org.freedesktop.secretsz/org/freedesktop/secretszorg.freedesktop.DBus.Peer.Ping) rrrlrlrGrHr6rsryr) kde_versionrs r_detect_linux_password_storers**..!6;AACKZj155k9MM zz~~()) zz~~-..   Y ' '   U$    !$ ( ' " (  ( ' s =/D D czV^8dQhR\\\,\\\\3,/#r)rrrnr)rs"rrrs*)R)RtCy#sC'E!F)Rrc\a .pR;p;r#Rp^RIHpV!4;'g/PR4;'g/o S PR4p\ T\ 4'd+\ P!T\PR8gR7pMW\ T\\34'd<TUu.uF/p\ T4P4'gK$\ T4NK1 ppRT 3R llpS PR R4p \ T \4'dT 'dR MR pMH\ T \ 4'd3\PT P4P4R4pT!R \ 4pT!RR4pS PRR4p \ T \4'dT pMc\ T \"\$34'd \T 4pM;\ T \ 4'd&T P4P4\&9pYY#T3# \d YY#T3u#i;iuupi)a``desktop.*`` launch options: ``(electron_flags, disable_gpu "auto"/"1"/"0", password_store, ozone_hint "auto"/"x11"/"wayland", renderer_accessibility bool)``; unknown values and config errors yield "auto"/[]/True so a malformed config never blocks the launch.autoTrgr`electron_flagsnt)posixc0V^8dQhR\R\/#rr)rs"rr-_desktop_launch_options..__annotate__'s11S1c1rc<SPVR4p\V\4'dVP4P 4MRpW19dV#R#)rr)rlrmrnrllower)rallowedrawlow desktop_cfgs&& r_choice(_desktop_launch_options.._choice'sDooc6*%/S%9%9ciik!rns0&0r disable_gpur@rrpassword_storeozone_platform_hintrenderer_accessibility)rx11wayland)rjrhrlr6rmrnshlexr@rrrrrlr_GPU_FLAG_WORDSr_LINUX_PASSWORD_STORESrfloat_A11Y_OFF_WORDS) flagsrr ozone_hintrrh raw_flagsrrraw_gpuraw_a11yrs @r_desktop_launch_optionsrsE066K6.!V1"}**// :@@b  01I)S!! Ibggo? Ie} - -!*=Ac!fllnQ=11 oomV4G'4  $c# GS ! !%))'--/*?*?*A6J -/EFN.0JKJ7>H(D!!!) HsEl + +"&h Hc " "!)!1!7!7!9!P ~;Q QQ? V>?UUUV>s'HHH-!H)H)H&%H&c$V^8dQhR\/#)r deferr)rs"rrr@src^RIHp^RIHpHpHpV!4'gR#V'dV!V4pVP 4V#V!V4pV'd\RV 24R# \dp\RT 24Rp?R#Rp?ii;i)aInstall the XDG desktop entry for Hermes Desktop (Linux only, best-effort). ``Exec`` and ``Icon`` are absolute so the entry works outside a login shell. ``hermes uninstall --gui`` removes it. ``defer=True`` (app-grid launch) returns a ``DeferredDesktopEntryInstall`` that writes the entry only once the Electron window is on screen (#111906); ``None`` when nothing is pending. Terminal, detached and ``--build-only`` launches install synchronously. r )DeferredDesktopEntryInstallinstall_desktop_entry is_supportedNu&✓ Desktop launcher entry installed: u2⚠ Could not install the desktop launcher entry: ) r#r!hermes_cli.linux_desktop_entryrrrrrar6)rr!rrrdeferredentryrs& r_register_linux_desktop_entryr@s- Jss~~ 2<@H NN O%l3  :5'B C  J B3%HII Js-A#A#A#A#A## B.BBintegrity_checkc V^8dQhR\R\R\\\.\\,3,,R\/#)r r rrr )rrrrn)rs"rrr[sC'''$('hvx}'<=>' 'rc \V4p\WR7'g)\V4\R4\ R\ 24hVf\ PR8Xd\pVe Ve V!V4MRpVeVeO\V4Vf\RV 24M\RVP RV R V 24\ R \ 24h\W4pVf(\R VR , 24\ R \ 24hV#)zVSign and verify before swapping; the default integrity check is Windows PE validation.)rvuY✗ The rebuilt desktop app could not be signed with a stable identity; not promoting it.z*Desktop signing refused the staged build. Nrxu0✗ Desktop build produced no launchable app in u✗ The built z failed its integrity check: z at: z*Desktop build produced no launchable app. u3✗ Could not install the rebuilt desktop app into rrz%Could not publish the desktop build. ) rsrrra RuntimeError_PREVIOUS_APP_KEPTr(r)r+rr)r rrstaged_executableerrorr*s&&$ r_promote_staged_desktop_appr[s3 8 D -[ R R !- " #GHZG[\]]3<<7#:6  (_-H )*NR  E$5 -  $ D[MR S N#4#9#9"::WX]W^_./1 2GHZG[\]]2;L" CKR[D[C\]^BCUBVWXX rc>V^8dQhR\\,RR/#)r rr Nre)rs"rrrs" g gXc] gt grcT;'gRpRV9dRV9g RV9dR#\R4\R4\R4\R 4\R 4\R 4R#) u%Print an actionable hint when a desktop build failed because esbuild's platform binary was never staged (`ignore-scripts=true` skips esbuild's postinstall, so the ``@esbuild/`` optional dependency is absent) — #53082. Best-effort: only adds context, never masks the original error.rz @esbuild/zcould not be foundzignore-scriptsNuO ⚠ This looks like esbuild's native binary is missing — commonly caused byzO `ignore-scripts=true` in your npm config, which skips esbuild's postinstallz0 that stages the @esbuild/ package.uP Fix: run `npm config get ignore-scripts` — if true, either set it to falsezW (`npm config set ignore-scripts false`), then reinstall: `npm ci` in the repo root,zY or stage the binary directly: `node node_modules/esbuild/install.js` in apps/desktop.)ra)rrs& r _diagnose_esbuild_ignore_scriptsrsa <.s 8!7##:!7sTFNc3@"TFqP4xK R#5irz)rU)rQdrivers& rrSrs4gTf&^^5E5ETfsd3d12GALLIUM_DRIVER)r$rrW_MESA_DRIVER_OVERRIDES_WSL_DXG_DEVICEr_WSL_D3D12_DRIVERS)r8rsf r_prefer_wsl_d3d12rs{ ( s 8!7 8sss 8!7 888 xxO**,,4gTf4g4gTf4g1g1g ' 2h,xrz!/scoped_dirXXXXXX/SingletonSocketHERMES_DESKTOP_TMPDIRc|V^8dQhR\PR\\\\ ,3,/#)r rr )argparse Namespacerrkrrn)rs"rrrs-+&+&h00+&U4c?5K+&rc^RIHpHpV!4pVPRR4p\P R8Xd;\ \P!V44\8dWC\&V!4VR&\V4RFwrV\WR4'gKRW6&K \VRR4'd>\\VP4P!4P#44VR &\VR R4pV'd1\\V4P!4P#44M\P$!4VR &\'4wrrp V R 8wdR \P(9dWR &V R 8wdR\P(9dWR&V 'gR\P(9dRVR&\P R8Xd5R\P(9d V R 8wdT M \+4p V 'dWR&W83#)zElectron child env + config-supplied extra flags. ``desktop.*`` config is bridged to env vars Electron already reads; an explicit env var wins over config (and over keychain detection).)socket_safe_tmpdirwith_hermes_node_pathTMPDIRrrAFr@ hermes_rootNHERMES_DESKTOP_HERMES_ROOTrHERMES_DESKTOP_CWDrHERMES_DESKTOP_DISABLE_GPUELECTRON_OZONE_PLATFORM_HINT%HERMES_DESKTOP_RENDERER_ACCESSIBILITYrrHERMES_DESKTOP_PASSWORD_STORE)) fake_bootHERMES_DESKTOP_BOOT_FAKE)ignore_existingHERMES_DESKTOP_IGNORE_EXISTING)r$rrrlr(r)rrfsencode_ELECTRON_TMPDIR_MAX_BYTES_DESKTOP_TMPDIR_ENVrgetattrrnrr expanduserr5getcwdrrr)rrrr8tmpdirattrrrconfig_electron_flagsconfig_disable_gpuconfig_password_storeconfig_ozone_hintconfig_renderer_a11yrs& r_desktop_launch_envrsK  !C WWXr "F ||w3r{{6':#;>X#X$*  *,H cj  4u % %CHjt]D)),/T5E5E0F0Q0Q0S0[0[0],^ () $t $CILDI$8$8$:$B$B$D ERTR[R[R]C !n/DYmV#(DBJJ(V,> ()F"'ERZZ'W.? *+ $KSUS]S]$]7: 34 ||w#B"**#T%:f%D !JfJh  3A/ 0  %%rc bV^8dQhR\R\R\R\\,RR/#)r r r\rr*r Nr)rs"rrrsAqqq%)q;?qV^_cVdq qrcTV'd\V4'gB\RVR, 24\R4\R4\P!^4\ V4R, P 4'g<\R4\RV R24\R4\P!^4\R VR, 24R #VfD\R VR , 24\R 4\R4\P!^4R #\ RV 24R #)z^Validate the pre-built artifact ``--skip-build`` promised; exit with a hint when it's missing.uC✗ --skip-build --source was passed but no desktop dist found at: rz4 Pre-build first: cd apps/desktop && npm run buildzG Or drop --skip-build to install dependencies and build automatically.rIuK✗ --skip-build --source requires existing desktop workspace dependencies.z Install first: cd z && npm ciuI→ Skipping desktop source build (--skip-build --source); using dist at NuF✗ --skip-build was passed but no packaged desktop app was found at: rrz3 Pre-build first: cd apps/desktop && npm run packz0 Or drop --skip-build to package automatically.u9→ Skipping desktop package build (--skip-build); using )rrar(exitr2rr)r r\rr*s&&$$r_check_desktop_skip_buildrs#K00 WXcflXlWmn o H I [ \ HHQKl+n<DDFF _ ` ),zB C [ \ HHQK YZehnZnYopq  $ VWbenWnVopq CD @A   YZmYnoprcFV^8dQhR\R\\,/#rM)rrrn)rs"rrr.s  $ 49 rc4\V4.p\V4'gY\4'd0\V4'd\ R4VP R4V#\ P!^4V#\V4'dVP R4V#)zd``[exe, *sandbox flags]`` after the Linux sandbox fixup; exits when the sandbox can't be configured.⚠ Falling back to --no-sandbox because this Linux host restricts unprivileged user namespaces and the Electron sandbox helper could not be configured. --no-sandboxz--disable-setuid-sandbox) rnrnrDr_rarLr(rrq)r*launch_commands& r _packaged_desktop_launch_commandr.s-./N '(; < < * , ,1^_r1s1s m n  ! !. 1  HHQK  55H I I89 rcFV^8dQhR\R\\,/#r-r&)rs"rrr<s  d x} rcb\V4PpRV9gRV9d RV9dR#R#R#)uThe package manager owning a non-editable install at *project_root*, or None. A package-manager install (Homebrew, pip, distro packaging) places this code in a ``site-packages``/``dist-packages`` tree. Such a tree ships no ``apps/desktop`` source, so the build ladder below can never run — the caller must not treat it like a broken checkout. A Homebrew formula lives under a ``Cellar`` directory; any other site-packages owner is reported generically as pip. z site-packagesz dist-packagesCellarhomebrewpipN)rr)r\rs& r_site_packages_install_kindr <s8   $ $E%?e#;%.z9E9 rc$V^8dQhR\/#rr)rs"rrrLsTrc\PR8wdR#\R4pVP4'gR#^RIHpV!\ V4.VPR7p\RV RV R24R #) uLaunch a separately installed ``/Applications/Hermes.app``, if present. Returns True only when the app bundle exists and a detached launch was started — the caller then exits without touching the build ladder. r%Fz./Applications/Hermes.app/Contents/MacOS/Hermes)launch_detached)ru/→ Launched the installed Hermes Desktop app:  (pid rT) r(r)rrUhermes_cli.bundled_appr rnr*ra)r+r r=s r#_launch_installed_macos_desktop_apprLsh  ||xFGJ     6 3z?+1B1B CC ;J4VPi\m44V 'g\CR?R@PoV4 24VeVPK4RNp VeVPqV 4p VPrp V 'g\PtRA8Xd^RBI;H% .se45  !    m$ %X ) >seD E d eQ-S ( )t  sJ-2    DF    ,!  0 1 HHQK   9 8 8s[[.\#6 \#A\#\#\#?\#\#"\#*\#A]9^1(`.*_; [  \ &/\\ # ]6.]11]69 ^.%^))^.1 _8<1_33_8;,`+'`.*`++`.. `? c:V^8dQhR\\,/#r)rrn)rs"rrrFs 5 5S 5rc8^RIHpV!4pV'dRV.#.#)u``--profile `` for Electron when ``-p``/``--profile`` was on argv. Explicit flag only. A bare `hermes desktop` must not forward the sticky CLI profile — Electron would persist it over the stored desktop one. )explicit_cli_profilez --profile)r#rI)rIprofiles rr5r5Fs! 5"$G%,K !4"4rcjV^8dQhR\PR\R\\,RR/#)r rr8rr N)rrrkrrn)rs"rrrRs6::   :#':9=c: :rc F^RIHpHpHp^RIHpRUUu.uFwrx\ WR4'gKVNK p ppV 'd@\RRPV 4 R24\R4\P!^4V!V4p X Pf;\R V P R 24\R 4\P!^4\V P4.p \V P4'g_\4'd9\!V P4'd\R 4V P#R4M\P!^4V P%V4V P%\'44V!WV PR7p \RRPV 4 RV R24\P!^4R #uuppi Td<p \RT R 24\R 4\P!^4R p ? ELR p ? ii;i)uStart the desktop app this CLI ships inside, then exit. A bundled install has no source tree to build: the app is a signed, read-only artifact and this Python is a passenger in its resources. So the whole build ladder below is skipped and the launcher is started DETACHED — the user ran a CLI command, and the app must outlive the terminal it was typed into. The app's own single-instance lock turns a second run into "focus the running window". Never returns. ) NotBundledAppr resolve_bundle_layoutr Fu✗ rz* cannot apply to a bundled Hermes install.zB This app ships prebuilt and has no desktop source tree to build.u=✗ This Hermes is stamped as a bundled desktop install, but r#u? The install is damaged — reinstall Hermes from the website.Nu(✗ Found no Hermes Desktop launcher in rr)r8ru→ Launched Hermes Desktop: r&rr))z--sourcer)z --build-onlyr)z --force-buildr)rrMr rNr#r!rrarr(rlauncherapp_rootrnrnrDr_rLr4r5)rr8rrMr rNr!flagrrefusedlayoutrrr=s&&& rr0r0Rs]\,  JD 4u %    TYYw'((RST RS  &|4 88IKL OP  &//*+N ' 8 8 * , ,1^_e_n_n1o1o m n  ! !. 1 HHQK.)023 .v GC )#((>*B)C6#a PQHHQKS  McURSTU OP  s"GGGH %0HH )g??rTrT>basicrzryrwr})r@rHyeson)rrr;nooff)rrr;rXrYdisabled)F)rMESA_LOADER_DRIVER_OVERRIDELIBGL_ALWAYS_SOFTWARELIBGL_DRIVERS_PATH){__doc__loggingrGrrrrr)r=rrr{rsr(rrpathlibrtypingrrhermes_cli.desktop_consolerrhermes_platform.hostr getLoggerrrrr!rcompiler?r8r;rErZrcror'rsrrrrrrrrrrrrr)_PE_MACHINE_TO_NAMErrrrrr rr+r2r8r?rrcrnr{rrrrrrrrrrrrrr r r.rr<rDrKrRrYr_rnrq frozensetrrkfromkeysrrrrrrrrrrrrrrrrrrr rrFr5r0rrrrisB    %T&   , -Y: SsZZ cegerersjjQSUS`S`a 2 U ]0S*D :T&& ';# [ - &;R3n&7HY[b)'3DgO_afg#-: (.D(%P 6$XSXXv)&,_ @@"ASVAH6`5IM`5"&`5F +> \ R2K:&bT*&.b $&A79xb##bcwT]]#=sCwt}}UpruGvw4CD)RX6'AE'T g 320432lz" 56 67 &' $%  z (!3'J#KK-+&\q2   $e'P 5:r